Bruno API Client | Blog & News

How to Configure Secret Managers in Bruno v4

Written by Ganesh Patil | Jul 28, 2026

 

Secret managers solve one of the most common pain points in API development: keeping credentials out of collection files, rotating them without touching every developer's machine, and enforcing who gets access to what. Bruno v4 connects directly to HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault. This guide walks through exactly how to set each one up.

Table of Contents

Why Secret Management Matters for API Development

Every non-trivial API has credentials. Database passwords, API keys, OAuth client secrets, tokens. They are everywhere. The natural instinct is to paste them into environment variables or .env files and move on. That works for a single developer, but it breaks down quickly when teams grow and security requirements tighten.

The real challenges show up when you ask:

  • How do we rotate a credential? If the API key is hardcoded in fifty collection files across ten developers' machines, rotating it means a manual update round-trip to every person on the team.
  • How do we onboard a new engineer? Sharing a .env file over Slack or email means the credential has now escaped the vault before it ever reached Bruno.
  • How do we audit who used what? When a key leaks, you need to know which systems were using it. Environment files have no audit trail.
  • How do we enforce least-privilege? Not every developer needs production credentials. Secret managers enforce this at the identity level. Bruno just reads what it is allowed to read.

This is why engineering teams adopt dedicated secret managers like HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault. They centralise credential storage, enforce access control, provide audit logs, and support automatic rotation. Secrets never touch a developer's file system.

Bruno v4 connects directly to all three, so your collections can pull live credentials at runtime without anyone ever copy-pasting a secret.

What Changed in Bruno v4

⚠ Breaking changes in v4. Please read before upgrading.

In the app:

  • Secret Manager configuration has moved out of secrets.json and into environment files under a new externalSecrets block.
  • Secret Manager is now configured from the Environment UI, not from Collection Settings.
  • Opening a collection with a secrets.json triggers automatic migration. No manual step needed.
  • If secrets.json is marked read-only, migration will fail with no fallback. You will need to re-enter the configuration manually in the Environment UI.
  • The syntax is deprecated. New syntax: . Old syntax still resolves in v4. Removal planned for the next major release (at least 6 months away). One-click in-app migration tool ships in v4.2.0.

In the CLI:

  • The CLI does not auto-migrate. If it finds secrets.json without an externalSecrets block, it prints a warning and continues without secrets.
  • Fix: open the collection in the app first, let the migration run, then commit the updated environment file.
  • Credentials are now passed via --secrets-env-file <path> instead of --env-var.
  • AWS Secrets Manager and Azure Key Vault are now supported in the CLI (HashiCorp Vault was the only option in v3).

New variable syntax at a glance

Syntax Status
{{name.keyname}} New (recommended)
{{$secrets.name.keyname}} Deprecated, works until next major release

Configure HashiCorp Vault

HashiCorp Vault is the most widely used open-source secret manager. Bruno supports both Vault Server (self-hosted or enterprise) and HCP Vault (HashiCorp Cloud Platform).

Step 1 - Add the provider in Preferences

1

Open Bruno and go to Preferences → Secrets Manager. Click + Add Secret Manager.

2

Select HashiCorp Vault Server and choose an auth method:

  • Token — static Vault token. Simplest; good for local development.
  • App Role — Role ID + Secret ID pair. Best for CI/CD and automated pipelines.
  • LDAP — username and password via an LDAP/Active Directory-backed Vault.
3

Enter the Vault URL (e.g. http://localhost:8200) and credentials. Click Test Connection, then Add.

For HCP Vault, select HashiCorp Vault Cloud and provide your Client Credentials and project details.

 

Step 2 - Attach secrets to an environment

1

Open your collection → Environments → select the target environment → open the External Secrets tab.

2

Select your Vault account. Enter a Name (the alias in requests, e.g. db) and a Path (e.g. secret/data/db).

3

Click Fetch Secrets. The secret keys and values populate automatically.

 

Step 3 - Reference secrets in requests

Use these in any URL, header, body, or auth field and Bruno resolves them at runtime:

{{db.password}} 
{{db.username}}

 

Step 4 - Run with the CLI

Export credentials from Preferences → Secrets Manager → Export as .env, then run:

# Local CLI testing -  Token auth 
bru run collection/ --env Production --env-var authToken=your-vault-token

# AppRole auth
bru run collection/ --env Production \
  --env-var roleId=your-role-id \
  --env-var secretId=your-secret-id

# Bruno v4 env flag: --secrets-env-file
bru run collection/ --env Production --secrets-env-file hashicorp-secrets.env

Configure AWS Secrets Manager

AWS Secrets Manager is the native secret store for AWS workloads. It supports automatic rotation, fine-grained IAM policies, and is deeply integrated with RDS, Lambda, ECS, and other AWS services.

Step 1 - Add the provider in Preferences

1

Preferences → Secrets Manager → + Add Secret Manager. Select AWS Secrets Manager.

2

Choose your auth mode:

  • Manual - enter Access Key ID, Secret Access Key, optional Session Token, and Region.
  • AWS CLI - uses your active AWS CLI session (aws configure or environment variables).
3

Click Test Connection, then Save.

 

Step 2 - Attach secrets to an environment

1

Open your collection → Environments → target environment → External Secrets tab.

2

Select your AWS account. Enter a Name (alias, e.g. apiCredentials) and the AWS Secret Name or ARN.

3

Click Fetch Secrets.

 

Step 3 - Reference secrets in requests

Key names match the JSON keys inside the AWS secret:

{{apiCredentials.api_key}} 
{{apiCredentials.client_id}}

Step 4 - Run with the CLI

Export from Preferences → Export as .env, or create the dotenv file manually:

# Bruno exported .env file

BRUNO_AWS_ACCESS_KEY_ID=<your-secret> 
BRUNO_AWS_SECRET_ACCESS_KEY= 
BRUNO_AWS_SESSION_TOKEN= 
BRUNO_AWS_REGION=
bru run collection/ --env Production --secrets-env-file ./secrets.env

Setting Up Azure Key Vault

Azure Key Vault is Microsoft's managed secret, key, and certificate store. It integrates with Azure Active Directory and supports both interactive (az login) and Service Principal authentication.

Step 1 - Add the provider in Preferences

1

Preferences → Secrets Manager → + Add Secret Manager. Select Azure Key Vault.

2

Choose your auth method:

  • Manual (Service Principal) — enter Tenant ID, Client ID, and Client Secret.
3

Click Test Connection, then Add.


Step 2 - Attach secrets to an environment

1

Open your collection → Environments → target environment → External Secrets tab.

2

Select your Azure Key Vault account. Enter a Name (e.g. paymentSecrets) and the Vault Name (e.g. my-company-vault).

  • Azure CLI — uses your active az login session. No credentials to enter.
3

Click Fetch Secrets.

Step 3 - Reference secrets in requests

Key names match the secret names inside Azure Key Vault:

{{paymentSecrets.stripe-key}}  
{{paymentSecrets.webhook-secret}}

Step 4 - Run with the CLI

Service Principal:

BRUNO_AZURE_TENANT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
BRUNO_AZURE_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
BRUNO_AZURE_CLIENT_SECRET=your-client-secret

Azure CLI (existing az login session):

BRUNO_AZURE_AUTH_METHOD=cli
bru run collection/ --env Production --secrets-env-file ./secrets.env

Team Workflow Tips

Keep secrets.env out of git

Add it to .gitignore. Store it in your CI/CD secret store (GitHub Actions secrets, GitLab CI variables, AWS Parameter Store, etc.) and write it to a temp file at runtime.

Use the Export as .env shortcut

In Preferences → Secrets Manager, hover any account and click Export as .env. The file is ready to pass to --secrets-env-file immediately — no manual transcription needed.

One environment per stage

Each environment (Dev, Staging, Production) has its own externalSecrets block. Developers without production IAM access cannot fetch prod secrets even if they have the collection.

Migrate $secrets syntax now

Search your collection for $secrets and update to . A one-click migration tool arrives in v4.2.0, but migrating early reduces editor noise.

Conclusion

Bruno v4 connects your collections directly to the secret managers your team already uses. HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault are all first-class providers, both in the app and in the CLI. Configuration lives alongside your environments in version-controlled files, and credentials never touch your collection source.

Bruno is an open-source, native API client built for developers who want speed, privacy, and control. It's the fastest-growing API client in its space  and v4 is the release where it stops being just a request tool and starts being the development platform your whole team can build on.

Explore the full documentation
View full post